diff --git a/.github/workflows/release-standards.yml b/.github/workflows/release-standards.yml
index 8ab3362..ed2ddbd 100644
--- a/.github/workflows/release-standards.yml
+++ b/.github/workflows/release-standards.yml
@@ -2,6 +2,10 @@ name: release-standards
 
 on:
   workflow_call:
+    secrets:
+      RELEASE_APP_PRIVATE_KEY:
+        description: App key resolved from the protected release environment.
+        required: true
 
 permissions: {}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a333a5e..35b1b9b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,6 +15,9 @@ jobs:
   release:
     if: startsWith(github.ref, 'refs/tags/v')
     uses: ./.github/workflows/release-standards.yml
+    # Required even when the value exists only in the called job's environment.
+    secrets:
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     permissions:
       contents: write
       issues: read
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1902cf0..c0c36c1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,11 +4,11 @@
 <!-- markdownlint-disable MD012 -->
 <!-- markdownlint-configure-file { "MD024": { "siblings_only": true } } -->
 
-## [0.1.1](https://github.com/KofTwentyTwo/standards/compare/v0.1.0...v0.1.1) (2026-10-10)
+## 0.1.1 (2026-10-10) — unpublished
 
-First published standards bundle: policies, language profiles, architectures,
-configs, reusable workflows, templates, and tooling. The `0.1.0` baseline below was
-never published; its signed tag remains reserved after a workflow startup failure.
+The bundle passed CI, checksums, and all five provenance checks, but publication
+stopped before draft creation because the reusable caller omitted its environment
+secret contract. This signed tag and the `0.1.0` baseline remain reserved.
 
 ### Bug Fixes
 
diff --git a/docs/releases.md b/docs/releases.md
index db9aacf..f3c40d7 100644
--- a/docs/releases.md
+++ b/docs/releases.md
@@ -46,7 +46,9 @@ version and notes before merging. A `breaking` label alone does not change the v
    `release` with a maintainer reviewer and deployment access for `v*` tags only.
    Store `RELEASE_APP_PRIVATE_KEY` separately in these **environment secrets**;
    never as a repository secret or committed file. Environments in the reusable
-   publisher resolve their own secrets; caller workflows do not pass the key.
+   publisher resolve their own secrets, but the caller must explicitly pass the
+   secret name and the reusable workflow must declare it. The named contract does
+   not expose the tag-only value to caller jobs or nested CI gates.
    Keep `protect-main` and `protect-release-tags` intact; the App does not create
    tags or bypass review. Allow the SHA-pinned Release Please action if repository
    action restrictions require an explicit allowlist entry.
@@ -119,8 +121,10 @@ same Git/archive tool versions. The builder refuses an existing output directory
 ## Failed releases
 
 The initial `v0.1.0` tag was reserved by a workflow-startup failure; no bundle was
-published for it. The first published bundle is `v0.1.1`. Keep the original tag
-unchanged; use a new version when a tagged workflow needs a source fix.
+published for it. The `v0.1.1` publisher then stopped before draft creation because
+the caller omitted the environment secret contract. Both tags remain reserved;
+`v0.1.2` is the planned first published bundle. Keep these tags unchanged; use a new
+version when a tagged workflow needs a source fix.
 
 Never replace published assets or move/reuse a version tag. Fix a published error
 with a new release. A failed upload or publication leaves a draft; inspect its run